The **CISA** on Thursday officially included a critical security flaw affecting **ownCloud** in its **KEV** catalog. This move comes after intelligence indicated a Chinese-speaking threat actor weaponized the vulnerability to compromise a nuclear research organization in the Philippines. The vulnerability, identified as **CVE-2023-49105** (CVSS score: 9.8), is an authentication bypass in the WebDAV API. It allows an attacker to access, modify, or delete files without authentication if the victim's username is known and no signing-key is configured – which is the default setting. Disclosed by **ownCloud** in November 2023, the issue impacts "core" versions from 10.6.0 through 10.13.0 and was subsequently patched in version 10.13.1. **CISA**'s addition to the **KEV** catalog aligns with findings from **Hunt.io**, which recently identified an open directory on the host `31.58.209[.]241`. This directory contained custom Python scripts, open-source offensive security tools like **Sliver**, **Metasploit**, and **Mettle**, and exfiltrated data from two Philippine entities: a nuclear research body and a marine engineering and shipbuilding company serving the Philippine Navy. "The scripts targeted an **ownCloud** instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV," **Hunt.io** reported. A separate intrusion reportedly exploited a **WordPress** site managed by the marine engineering firm. The threat intelligence firm attributed these attacks to a Chinese speaker, citing the presence of simplified Chinese in source code comments, docstrings, log output, and data sorting folders. Five custom Python scripts found in the exposed directory were designed to exploit **CVE-2023-49105**. These scripts enable an attacker with valid usernames on an **ownCloud** instance to gain unauthorized access without providing credentials. "An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as an authentication action by that user, without ever supplying credentials," **Hunt.io** elaborated.  Of the five scripts, four targeted individual accounts, while the fifth enumerated the WebDAV directory and logged download attempts. The threat actor is estimated to have downloaded 176 files, totaling approximately 372 MB, from the nuclear research entity, storing them across five staging directories. Exfiltrated data included nuclear-material account records, draft strategic plans for 2023-2028, research reactor core components, historical fuel inventories, presentation materials, employee personal information, a 192 MB SQL dump of a **ZKTeco BioTime** attendance and personnel database, and credential stores such as **BitLocker** keys, a **KeePass** database, and **AxCrypt**-encrypted files. Concurrently, the threat actor exploited a critical flaw in the **LiteSpeed Cache** plugin for **WordPress**, **CVE-2024-28000** (CVSS score: 9.8), to gain elevated access to the **WordPress** site of the second Philippine company. Additionally, a Python script named "brute_xmlrpc.py" found in the open directory targeted the same site with an XML-RPC brute-force attack to guess account credentials, providing an alternative access vector independent of **CVE-2024-28000**. Further analysis of the **WordPress** source code revealed an active, possibly unrelated compromise utilizing **EtherHiding** to extract HTML content from an **Ethereum** smart contract. This ultimately served a Google verification page common in ClickFix-style attacks. The lure, in turn, executed "pcalua.exe" to invoke "mshta.exe" and download a **Visual Basic Script (VBScript)** dropper. "The operator, whether state-affiliated, contracted, or working independently, conducted a deliberate intrusion against Philippine nuclear and defense-adjacent organizations," **Hunt.io** concluded. "The marine engineering firm's ties to the Navy align with interests tied to current South China Sea tensions. The specific material sought out and exfiltrated from the nuclear agency are a separate but complementary priority." In light of the active exploitation of **CVE-2023-49105**, Federal Civilian Executive Branch (**FCEB**) agencies are strongly advised to apply the necessary patches by August 30, 2026. On the same day, **CISA** also added two other vulnerabilities to the **KEV** catalog: one impacting **Linux Kernel** (**CVE-2026-53362**) and another affecting **Artifactory** (**CVE-2026-66384**). This follows **OpenAI**'s disclosure that its artificial intelligence (AI) agents exploited both flaws to target its internal infrastructure last month. **OpenAI** clarified that "These activities were not part of, and did not contribute to, the chain of events that led to the Hugging Face compromise." Federal agencies have until August 30, 2026, to patch the **Linux Kernel** vulnerability and until September 10, 2026, to address the **Artifactory** bug.